@agentvault/grok-bridge 0.1.0

package/dist/log.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Prefix every line of `message` with an ISO-8601 UTC timestamp.
+ *
+ * Per-LINE, not per-call, on purpose: `logLine("[bridge] fatal:", err)` renders a
+ * multi-line stack trace, and a first-line-only stamp would leave every frame
+ * unanchored — the case where the clock matters most. The acceptance criterion
+ * on #790 is "every line in the file", so this reads it literally.
+ */
+export declare function stamp(message: string): string;
+/**
+ * Write one stamped record to stderr.
+ *
+ * stderr (not stdout) because the launchd/systemd unit routes both, and the
+ * bridge's existing sinks were already `console.error` — keeping the stream the
+ * same means this change alters the CONTENT of the logs and nothing else.
+ *
+ * Multi-arg is supported via `util.format`, which is what `console.error` uses
+ * internally, so `logLine("[bridge] fatal:", err)` renders exactly as before —
+ * just anchored to a clock.
+ */
+export declare function logLine(...args: unknown[]): void;
+//# sourceMappingURL=log.d.ts.map

package/dist/service/backend.d.ts

@@ -0,0 +1,29 @@
+import type { ServiceSpec } from "./spec.js";
+export interface ServiceBackend {
+    install(spec: ServiceSpec): void;
+    uninstall(label: string): void;
+    /** Restart an ALREADY-INSTALLED service without touching its spec (#837).
+     *  Distinct from install, which re-bakes the plist from the current shell. */
+    restart(label: string): void;
+    status(label: string): {
+        loaded: boolean;
+        detail: string;
+    };
+}
+export interface BackendDeps {
+    home: string;
+    uid: number;
+    user: string;
+    exec: (cmd: string, args: string[]) => {
+        code: number;
+        stdout: string;
+    };
+    writeFile: (path: string, data: string) => void;
+    mkdir: (path: string) => void;
+    chmod: (path: string, mode: number) => void;
+    rm: (path: string) => void;
+    exists: (path: string) => boolean;
+}
+export declare function defaultDeps(): BackendDeps;
+export declare function selectBackend(platform: NodeJS.Platform, deps?: BackendDeps): ServiceBackend;
+//# sourceMappingURL=backend.d.ts.map

package/dist/service/backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../../src/service/backend.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B;kFAC8E;IAC9E,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5D;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChD,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;CACnC;AAED,wBAAgB,WAAW,IAAI,WAAW,CAoBzC;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,cAAc,CAU3F"}

package/dist/service/launchd.d.ts

@@ -0,0 +1,21 @@
+import type { ServiceSpec } from "./spec.js";
+import type { BackendDeps, ServiceBackend } from "./backend.js";
+/** Render a launchd LaunchAgent plist for a bridge ServiceSpec. Pure string. */
+export declare function renderLaunchdPlist(spec: ServiceSpec): string;
+export declare class LaunchdBackend implements ServiceBackend {
+    private deps;
+    constructor(deps: BackendDeps);
+    private plistPath;
+    private domain;
+    install(spec: ServiceSpec): void;
+    private waitUntilGone;
+    /** #837: restart in place. Same kickstart install ends with, WITHOUT
+     *  rewriting the plist — so env baked at the original install survives. */
+    restart(label: string): void;
+    uninstall(label: string): void;
+    status(label: string): {
+        loaded: boolean;
+        detail: string;
+    };
+}
+//# sourceMappingURL=launchd.d.ts.map

package/dist/service/launchd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"launchd.d.ts","sourceRoot":"","sources":["../../src/service/launchd.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAUhE,gFAAgF;AAChF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAkC5D;AAED,qBAAa,cAAe,YAAW,cAAc;IACvC,OAAO,CAAC,IAAI;gBAAJ,IAAI,EAAE,WAAW;IAErC,OAAO,CAAC,SAAS;IAGjB,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI;IA2BhC,OAAO,CAAC,aAAa;IAOrB;+EAC2E;IAC3E,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAI5B,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAM9B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;CAI3D"}

package/dist/service/launcher.d.ts

@@ -0,0 +1,16 @@
+import type { ServiceSpec } from "./spec.js";
+import type { BackendDeps } from "./backend.js";
+export declare const FALLBACK_NODES: string[];
+/** Render the bash launcher the service actually execs. Pure string. It prepends
+ *  the install-time PATH, then execs the first resolvable node with the bundle
+ *  entrypoint. If NO node is found it exits 0 (terminal — never a restart-loop,
+ *  same philosophy as auth-failure) after logging a re-install hint. */
+export declare function renderLauncher(opts: {
+    installPath: string;
+    entrypoint: string;
+    fallbacks?: string[];
+}): string;
+/** Write the launcher executable (0755) into the data-dir before the backend
+ *  points the service at it. Shared by both platform backends. */
+export declare function writeLauncher(deps: BackendDeps, spec: ServiceSpec): void;
+//# sourceMappingURL=launcher.d.ts.map

package/dist/service/launcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"launcher.d.ts","sourceRoot":"","sources":["../../src/service/launcher.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAKhD,eAAO,MAAM,cAAc,UAO1B,CAAC;AAcF;;;wEAGwE;AACxE,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB,GAAG,MAAM,CAoBT;AAED;kEACkE;AAClE,wBAAgB,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAIxE"}

package/dist/service/spec.d.ts

@@ -0,0 +1,20 @@
+import type { BridgeConfig } from "../config.js";
+export interface ServiceSpec {
+    label: string;
+    programArgs: string[];
+    launcherPath: string;
+    launcherScript: string;
+    env: Record<string, string>;
+    workingDir: string;
+    logOut: string;
+    logErr: string;
+    keepAliveUnlessCleanExit: boolean;
+    runAtLoad: boolean;
+}
+export interface BuildSpecOptions {
+    entrypoint: string;
+    home: string;
+    path: string;
+}
+export declare function buildServiceSpec(cfg: BridgeConfig, opts: BuildSpecOptions): ServiceSpec;
+//# sourceMappingURL=spec.d.ts.map

package/dist/service/spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.d.ts","sourceRoot":"","sources":["../../src/service/spec.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAGjD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,wBAAwB,EAAE,OAAO,CAAC;IAClC,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAID,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,GAAG,WAAW,CAyBvF"}

package/dist/service/subcommand.d.ts

@@ -0,0 +1,11 @@
+import { type ServiceBackend } from "./backend.js";
+export interface ServiceCmdDeps {
+    backend?: ServiceBackend;
+    entrypoint?: string;
+    log?: (msg: string) => void;
+}
+/** Handle `agentvault-grok-bridge <install|uninstall|status|logs>` before boot.
+ *  Returns true when handled (caller should exit). Secrets are never placed on
+ *  the service command line — config flows via the plist env; the token is omitted. */
+export declare function maybeRunServiceSubcommand(argv: string[], env: NodeJS.ProcessEnv, deps?: ServiceCmdDeps): boolean;
+//# sourceMappingURL=subcommand.d.ts.map

package/dist/service/subcommand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subcommand.d.ts","sourceRoot":"","sources":["../../src/service/subcommand.ts"],"names":[],"mappings":"AAGA,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAElE,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAQD;;uFAEuF;AACvF,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CA4DT"}

package/dist/service/systemd.d.ts

@@ -0,0 +1,22 @@
+import type { ServiceSpec } from "./spec.js";
+import type { BackendDeps, ServiceBackend } from "./backend.js";
+/** Render a systemd --user service unit for a bridge ServiceSpec. Pure string.
+ *  Restart=on-failure + SuccessExitStatus=0 is the KeepAlive={SuccessfulExit:false}
+ *  equivalent: a clean exit(0) (revoked device) is treated as success => NOT
+ *  restarted; a non-zero crash is restarted. WantedBy=default.target is RunAtLoad. */
+export declare function renderSystemdUnit(spec: ServiceSpec): string;
+export declare class SystemdBackend implements ServiceBackend {
+    private deps;
+    constructor(deps: BackendDeps);
+    private unitPath;
+    install(spec: ServiceSpec): void;
+    /** #837: restart in place, without daemon-reload or rewriting the unit —
+     *  so env written at the original install survives. */
+    restart(label: string): void;
+    uninstall(label: string): void;
+    status(label: string): {
+        loaded: boolean;
+        detail: string;
+    };
+}
+//# sourceMappingURL=systemd.d.ts.map

package/dist/service/systemd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"systemd.d.ts","sourceRoot":"","sources":["../../src/service/systemd.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAmBhE;;;sFAGsF;AACtF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAsB3D;AAED,qBAAa,cAAe,YAAW,cAAc;IACvC,OAAO,CAAC,IAAI;gBAAJ,IAAI,EAAE,WAAW;IAErC,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI;IAoBhC;2DACuD;IACvD,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAI5B,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAU9B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;CAQ3D"}

package/dist/version.d.ts

@@ -0,0 +1,7 @@
+/** #836: identify the BRIDGE the operator installed, not the plugin it vendors.
+ *
+ *  This lives in its own module on purpose: `index.ts` runs `main()` at module
+ *  scope, so importing it from a test would spawn the real grok binary and open
+ *  a SecureChannel during the test run. */
+export declare function buildClientVersion(version: string | undefined): string;
+//# sourceMappingURL=version.d.ts.map

package/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "@agentvault/grok-bridge",
+  "version": "0.1.0",
+  "type": "module",
+  "description": "AgentVault Grok Bridge — daemon bridging a Grok agent into E2E-encrypted AgentVault direct messages and rooms.",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "bin": { "agentvault-grok-bridge": "dist/index.js" },
+  "engines": { "node": ">=18" },
+  "files": ["dist", "README.md", "!dist/*.map"],
+  "scripts": {
+    "build": "npm --prefix ../plugin run build && tsc --emitDeclarationOnly && node build.mjs",
+    "start": "node dist/index.js",
+    "test": "vitest run",
+    "gate:mac": "RUN_MAC_GATE=1 vitest run src/__tests__/sandbox-gate.mac.test.ts",
+    "typecheck": "tsc -p tsconfig.test.json",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": { "ws": "^8.16.0", "zod": "^4.3.6" },
+  "devDependencies": {
+    "@agentvault/agentvault": "file:../plugin",
+    "esbuild": "^0.27.3",
+    "typescript": "^5.4.0",
+    "vitest": "^2.0.0",
+    "@types/node": "^20.0.0"
+  },
+  "publishConfig": { "access": "public" },
+  "license": "MIT"
+}